Slashdot Mirror
FBI Databases Used for Stock Fraud
Phronesis writes "The Associated Press reports that two FBI agents have been indicted for conspiring with the owner of InsideTruth.com to short stocks and then leak information from the FBI's internal databases (e.g., unpleasant personal information about corporate officers). They also allegedly blackmailed companies with the threat of revealing such information. This case illustrates the failure of law enforcement agencies to implement adequate protection against the abuse of information they collect."
Why these guys were collecting such information in the first place. Seriously, there are a lot of privacy activists out there, but it seems to me that the vast majority of them are complaining about the cookie-of-the-month problem when what they should really be looking at are the kinds of scams government data collecting enables. Identity theft, for instance, wouldn't be possible if not for the ubiquity of Social Security numbers as a "citizen ID" of sorts.
Dog is my co-pilot.
So yet another case of government intruding privacy, and yet the same government is against encryption, embraces companies that sell privacy info and can't make a proper bill about privacy?
Little wonder we trust them.
Think nothing is impossible? Try slamming a revolving door.
Anyone who thought that the FBI is beyond reproach only had to look at the Hanssen case. This one, however, is even more interesting because it represents commercial use of sensitive information. I will treasure this as an example of why Governments should also have a 'need-to-know' applied to them.
This illustrates once again that the most frequent abuses of security are inside jobs. The vast majority of cases where security systems are breached for personal gain are done by people inside the organisations keeping the data.
How much bigger would this story be if the data had come from hackers penetrating the FBI? Since its an inside job, its not front page news.
We don't need huge security structures and new laws to keep out black hat hackers, we need a closer watch on people inside companies and organisations keeping data. And, if the data isn't needed for a clear purpose, it shouldn't be collected.
And that applies as much to government agencies as companies, since the people inside those, as this case proves, can't be trusted either.
Here's my suggestion: Have the FBI, or even some more reputable organization, run a full-bore background check on them, followed by total surveillance for some period of time from 30 days to life, depending on the seriousness of the violation.
Then post the results, complete with photos and video clips, on a website for the duration of the sentence.
I see that privacyviolators.com is available, as is publicstockade.com.
If only we had similar penalities for spammers.
I wish I could make a joke about Wingate, (there has to be one someplace) but I don't realy have enough coffee in me yet.
"It is a greater offense to steal men's labor, than their clothes"
Come on. We've known forever that the FBI has huge files on tons of people, there where stories about the FBI file on einstein on here a week or so back. Had it been the actual FBI selling this information and not a couple of bad apple agents pissed they didn't get a raise this year then perhaps it would be a huge story.
As it is, this just shows they need a little stronger check as to who has access to what, but they did catch the people so I am assuming some checks are already there.
--"Karma is justice without the satisfaction"
Stock Fraud
:-)
Glad to see the FBI is doing something useful
Tales from behind the Lagom Curtain
I can see how many are afraid of the deeds of organizations such as the KGB, GRU, Gestapo, Stazi, and FBI/CIA. This gives a fear of any form av compulsory identification, and a misstrust of the goverment agencies for law enforcement.
The problem here is that system is rotten, and with presidents who are obviously lying their pants off (pun very much intended) constantly, these FBI agents probably didn't feel bad about doing these deeds.
So off course we are afraid of the information collected, since it not only can, but apparently will be used against us. That is the problem, that the information that is supposed to protect us, is used against us.
I don't have a clue on how to fix a system this corrupt, with indivudauals this ruthless. The only advice I can give you all is to not act like these peoples and be a good role model for your friends and family.
Mr. Smith
otherwise they are just normal people. FBI employees around 30 000 people. A little city. I bet they use the database for criminal purposes hundreds of times every day.
A clip from here:
" The Webster commission is expected to recommend limiting highly sensitive files to those with a strong need-to-know -- "role-based access," in FBI jargon. "
'Expected to recommend...' exactly what is the procedure currently?!?! These systems and their databases are extremely scary.
As governmental databases will reach critical mass, especially with cross-indexing and cross-searches are made more and more common (Oracle database proposals anyone?), I can safely predict that this kind of abuse will only become more and more common.
Do you still think your government does not spy on you? Think again...
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
No. Fundamentally, this case illustrates the corruption of power. Governments are made up of lots of individuals, with their own problems, stresses and challenges. They are not angels. If the opportunity to profit from their position appears, many will take it. Putting more levels of bureaucracy and control is just a form of "moving the problem around."
If you want to grant the government more power to accomplish things, abuse of power is the natural, and practically inevitable result. Get used to it. It will happen more and more often over time as we surrender more and more of our freedoms. Especially for the never-ending war on terrorism.
The question we should be asking is "Why does the FBI have this data in the first place?", not "why aren't there sufficient controls to protect this data?"
This is an outrage! FBI agents using personal information collected by the agency on citizens to promote their own interests? Obviously we just need to change the administration of the FBI; after all, this would have never happened under the first and greatest FBI chief, J. Edgar Hoover!
Er... wait a minute...
Seriously, I've just come to expect that the FBI is going to be corrupt and incompetant until the day that it is disbanded and replaced by another institution, which will probably just follow suit anyhow. The place just begs for it; national authority, minimal oversight, intentional segregation from other government offices, a long history of this sort of abuse with little public repercussion, etc.
Where in the hell else do you think our extremists, fascists, and power-hungry psychos are going to try to get into? It sucks that there are actually some good people that work in the FBI since they have to get caught up in this crap as well, but at least there are good parts to it. But I'll be damned if I'm ever going to trust the FBI in general, given, oh, decades of an example to go by. The USA PATRIOT act did us a favor by potentially saving us a fortune in investigations by making legal what the FBI was going to do on their own anyhow.
"This case illustrates the failure of law enforcement agencies to implement adequate protection against the abuse of information they collect."
This case illustrates the failure of trusting and empowering large beaurocratic entities to snoop into everyone's lives in the mistaken notion that will somehow make us all "safer."
Individuals have never come close to committing the level and magnitude of atrocities that governments, including our own (USA), have, in terms of lives destroyed and even taken, not to mention human suffering in unthinkable numbers. Consider WW I, WW II, the Nazi regime, the Stalin regime, the Mao regime, the Khmere Rouge regime, the Saddam Hussein regime, and the Taliban regime. Even Osama bin Laden, with government support was unable to match any of those in shere atrocities committed (and what Osama "the fallatio queen" bin Laden did manage to do he likely couldn't have pulled that off without ongoing aid and support from the Taliban regime).
If events like these do not illuminate the fallacy of giving up freedom and handing the government authority over our lives in the mistaken notion that it will keep us safer, then really nothing will and our society as such is doomed.
The Future of Human Evolution: Autonomy
I don't get it. They inform investors about the shady past of executives. Who wouldn't want to know that???
This sort of thing is the answer to that constant refrain when one tries to protest or object to the ever-increasing government surveillance, information and data interception and storage. "I've done nothing wrong, so I've got nothing to hide." You may not have broken the law, but mebbe your husband would be interested to know about that drunken fling a couple of years ago at the office christmas party, and say, aren't these expenses claims a bit... creative? And tell me, why ARE you browsing gay porn from home, what with you being married with kids? and so on, and on. Humans are of course the weakness in all these systems promoted by clue-lite technocrats - those politicians who advocate technological solutions to everything, but who don't read the RISKS digest, or CryptoGram, or Incidents, Bugtraq, "Crash!" (the Tonty Collins book, not the Ballard one...) and so on.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
these guys would just find out little companies (traded OTC [over the counter], not on the nasdaq or NYSE) that were being investigated by the FBI for wrongdoing. then, the guy would borrow a lot of shares of the company (these were very small companies, so we;re talking about penny stocks. i.e., $0.42 a share) then immediately sell them, trash the company and recommended selling the shares on their website and then waited for news about the FBI investigating them to break. this would, invariably, cause the stock to drop substantially (a drop from $0.42 to $0.21 would be a 50% drop) then these guys would re-buy the stock and give it back to whomever they borrowed it from. this gave them a substantial profit.
they were finding out which companies were being investigated by the FBI and then trading based on that information. it wasnt because of gov't data collecting, but, rather, because of gov't investigating.
------
[insert funny
The real problem here is that our government is so powerful that it is allowed to collect such information on us in the first place. Look, people: it's an intelligence organization. Once they have the information, they are unaccountable to anyone as to what they do with it. There is no public oversight of the FBI, because that would violate "national security."
So, you think, "I'm not so important. The FBI isn't coming after me." Repeat the litany about not speaking up for the Jews, etc. and realize that this particular abuse is only one of countless ways in which our too-powerful federal government violates our rights on a daily basis.
Don't be so quick to give up rights you don't exercise: instead, think of what kinds of rights you exercise that the majority might not care about (fair use, use of strong cryptography, etc.), and realize that if you have the ability to surrender their rights, they have the ability to surrender yours.
Do you want small government? Join the Libertarian Party.
[ home ]
That is what security services are for.
[ begin Max Headroom quote]
"Protecting your right to unlimited television and consumer credit.
"Security Systems. In your home, in your place of work, wherever you go, there we are."
[ end Max Headroom quote ]
The Future of Human Evolution: Autonomy
but Absolute Power would be cool!
Best Slashdot Co
In this case, the FBI had a legitimate reason for having the data. The abused persons were under active FBI investigations at the time. As stated above, the agents would borrow shares of a small company when they knew that one of the principals of the company was under investigation. They'd sell the shares, leak the bad secrets, wait for the share price to fall, buy them back, return them to the original owners, and pocket the difference. It's certainly abuse, but in this particular case the FBI as a whole had good reason to have the data.
Virg
Actually, they were leaking information about ongoing investigations to affect stock prices. The way they'd do this is to borrow stocks in companies whose principal(s) were under investigation, sell the stock, leak the data, wait for the stock price to fall, buy back the shares, return them to the original owners, and pocket the rest. So, in answer to your question, the "who"s that wouldn't want this:
1.) The individuals under investigation. Remember, they are innocent until proven guilty, and more than half of people investigated by the FBI are exonerated, so the reputation damage done by the leak may not be deserved.
2.) The stockholders, both the ones from whom the stocks were borrowed and other stockholders whose investments are getting trounced by these leaks. Remember, more than half of these investigations do not result in charges.
3.) Others who are also being investigated by the FBI. What assurance do they have that they won't be the next targets of this?
4.) The stock market in general, which takes a very dim view of insider trading of any kind, since it undermines faith in the system, which is key to its survival.
That ought to be enough to start with. The thing to remember in this is that they were not just leaking data about past offenses, they were leaking the fact that they're under investigation currently.
Virg
I know this is paranoid, but it is interesting to note that the same agents could have access to information gathered from the carnivore tool db and use it to threaten internet users for not paying tax on time or whatever if given some cash by certain other companies. The opportunities for abuse are boundless when the system itself is corrupt.
People won't REALLY understand the scope of the SS#/identity-theft problem when you relate it as an ID number and not as a Password.
The solution is to detour companies from using your SS# number as a password by making them liable for any damages, then add some fines on top of that.
"Communism is like having one [local] phone company " - Lenny Bruce
It's amazing how as more and more police powers are being granted that the whole innocent until proven guilty thing is going out the window.
These days they collect information on bad tips, and hunches. The lack of oversight is appalling. I do admit that some of the laws where overly tight. The whole must get a warrant for each device for tapping is a bit extreme, even as a privacy advocate. What I don't like are the fishing expeditions that they're engaging in now. Especially they're imply threats against those who don't cooperate. The whole "your unamerican and not patriotic" if you don't wholly bend over and take it from law enforcement is a bit much.
Speeding for me is a great example. Arbitrarily enforced and most often broken by officers without need (no lights or sirens). It seems that many officers take their badge as a right to be outside the law. TV shows and movies make police look bad, but when some of the real stories come out... it's usually so much worse then the fiction that you wonder why we ever wanted to trust these people.
I will also be the first to admit that law enforcement is a thankless task. I do appreciate those individuals that are honestly serving.
You just can't win.
Last year, the Detroit Free Press ran a two part story about police officers who abused a law enforcment data base, which is tied into the FBI's NCIC, for personal reasons.
m
m
http://www.freep.com/news/mich/lein31_20010731.ht
Cops tap database to harass, intimidate
July 31, 2001
First of two parts
BY M. L. ELRICK
FREE PRESS STAFF WRITER
Police throughout Michigan, entrusted with the personal and confidential information in a state law enforcement database, have used it to stalk women, threaten motorists and settle scores....
Police said they think the system, which is used to make about 3 million background checks each month, is more widely abused than anyone knows...
Despite rules limiting LEIN use to law enforcement purposes, police told the Free Press their colleagues use LEIN to check out attractive people they spot on the road.
"I'm not going to be so naive as to say an officer hasn't seen a pretty girl and run her plate," said Carey, who also was once chief in Troy.
Former Memphis Police Chief Phillip Ludos said the practice is so common it is known simply as "Running a plate for a date."...
A few months ago, the Free Press did a follow-up, about how the Detroit police handled the offenders:
http://www.freep.com/news/mich/lein26_20020426.ht
Abusers' names to be wiped out
Officers who misused LEIN won't be traceable
April 26, 2002
by M.L. Elrick
Free Press Staff Writer
LANSING -- State officials made it harder Thursday for the public to learn who has abused the confidential Law Enforcement Information Network (LEIN), a computer database containing driving records, criminal records and other personal information.
Reversing their practice of keeping the names of police and others who abuse the system, the Criminal Justice Information Systems Policy Council voted to delete the names after investigating each case.
The council, made up of prosecutors, police and state officials, made the change after state and local police officials expressed concerns that maintaining a database of abusers would violate labor contracts, which limit the amount of time a transgression can remain on an employee's record...
"This case illustrates the failure of law enforcement agencies to implement adequate protection against the abuse of information they collect."
Michael, take a deep breath. You're starting to sound like Jon Katz.
This case illustrates exactly why mandatory encryption key repositories are a bad idea. It illustrates why keeping excessive information is a problem. It highlights the fact that we don't live in a safe world.
We will never. Ever. Ever! eliminate leaks, corruption, and fraud. If the information exists at all, then there's no way of protecting it perfectly from unintended use. (Which, it occurs to me, is exactly why people have argued against copy-protection. Hmmm...) Sooner or later someone will find a way of getting to it and exploiting it.
Note also that (as others have pointed out), the law enforcement agencies worked!" The perps were caught and punished, exactly like they should be.
The only answer we have to threats like this goes as follows.
1) Limit the amount of information collected to what's necessary. (in this case, the info. was necessary. Private key repositories are definitely not)
2) Limit the amount of cross-referencing between separate databases.
3) Implement and enforce legal protections on the data.
4) Implement and enforce technical protections on the data.
5) (really 3a) When things are abused or leaked, punish the perpetrators and reevaluate policies 1-4.
This is old, old, OLD stuff but is changing now for a few reasons. Massive networking, storage, and databases are fundamentally contrary to items (1) and (2). Technology moving as fast as it is makes (4) a difficult moving target. The fact that too many people (legislators and judges especially included) consider this to be a different situation than it was 25 years ago makes (3) more complicated than it should be.
In other words, reevalutate, enforce, and repeat.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
His name is Robert Hanssen.
Yours, very sincerely,
Robert Hansen
P.S.: Note that my last name is spelled with one S.
P.P.S.: Note that I'm not the infamous Alaskan serial killer, Robert Hansen, either.
:)
Here's my suggestion: Have the FBI, or even some more reputable organization, run a full-bore background check on them, followed by total surveillance for some period of time from 30 days to life, depending on the seriousness of the violation.
Your suggestion just moves the problem; who watches the watchers? This reminds me of many "fault tolerant" comptuers, in reality they just move the critical failure point to another location; it still leaves the device with a failure point. Read the other insightful posts on this list. Why did they have the information in the first place?
When I apply for a job, they do a background check, including finding out whether or not I've committed any felonies. Why shouldn't I be able to do the same?
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
As you know, it takes a great deal of money to track down terrorists. To help save money in this effort, John Ashcroft has created a special form where you can help provide the information about yourself so that our govenment can better use its resources on the real terrorists. Please fill out the form now, help us fight and win this war against terror! Also please find articles on the Homeland Security page to help you identify potential terrorists and report them.
Exactly. And the other source for the information is the NCIC database, which is maintained by he FBI and routinely used by all levels of law enforcement. It contains information on criminal convictions, stolen property, etc. It's used so that the police in different states all have access to the same basic information about various criminals and crimes. It is NOT the eeevil secret file on every citizen that some people seem to imagine.
If they are unaccountable, why are these agents being indicted for misuse of the information?
Isn't that a contradiction?
Most of their disclosures about companies seem to be based on public information. Court records are a major source. Here's a sample report, on SeaView Video Technologies.
The "inside information" from the FBI may have only been hints as to what court records to look at. Court records are public, but not well indexed. Law enforcement generally has better indexing of court records than the courts themselves. So this guy may have been using the FBI mostly as a search engine for public documents.
It's legal to issue reports on a stock that you're trading, provided that you disclose that you're doing so. That's very common, and a source of much of the hype coming from Wall Street analysts.
The press reports don't say that this guy's information was wrong.
Absolute power attracts the absolutely corruptible.
Fair enough, but that saying has a much different meaning from the original.
Tell me why I'm taxed for this service.
Had it been the actual FBI selling this information and not a couple of bad apple agents pissed they didn't get a raise this year then perhaps it would be a huge story.
Tell me the practical difference. Tell me that the agents involved are not scape goats. Who's gaurding the gaurds? More gaurds? Hmmm.
The abuse of seemingly reasonable laws by corrupt officials is one of the reasons we have a bill or rights. You think you are very well informed, but are not. I suggest you read some history before you tell me to "Come on" again. It is a big deal. The government is NOT supposed to be in a position to do this, no matter how honest you think an government agency can be. Without power, there's no need for checks on it's abuse.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
What they have is citizen information databases. Criminal information databases collect information on crimes. They had dirt files on innocent people collected for what? Routine monitoring? I don't need a monitor and I'm not going to pay you to do it.
The FBI's mission needs to be defined better than this. I'm not going to sit here and try to draw a line for them, I'm going to demand that they figure out what they should be doing and convince people it's right before they do it. Incidents like this go a long way toward convincing people that we don't need a federal police force.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.